CVE-2012-1457: Antivirus TAR parser malware detection bypass via oversized length field

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

medium priorityCVSS 2.0 base score is 4.3 (medium) with only integrity impact, but the flaw defeats malware detection across many widely deployed scanners and EPSS is extremely high.

What it is

The TAR file parser in numerous antivirus and anti-malware products mishandles a TAR archive entry whose length field exceeds the total TAR file size, allowing malware to evade detection. Because the flaw affects the scanning engine itself, a malicious archive can pass through the very control meant to catch it. The record notes it may later be split into multiple CVEs if the error is shown to occur independently across parsers.

Impact

An attacker gains the ability to deliver malware inside a crafted TAR archive that the affected scanner fails to flag, undermining the primary detection control. There is no reported confidentiality or availability impact; the effect is a bypass of malware detection.

Attack surface

Reached remotely over the network by submitting a crafted TAR archive to a system whose antivirus or anti-malware engine parses it. No authentication is required, but the CVSS vector indicates medium attack complexity and no user interaction is specified.

Exploitation

Not listed in CISA KEV and no ransomware associations are documented. EPSS is very high (0.98331, 99.9th percentile), but the references carry no exploit tags, so active exploitation is not confirmed by this record.

What to do

• Apply vendor updates for the affected antivirus/anti-malware engines; the record does not list fixed versions, so confirm with each vendor.
• Where no fix is available, disable or restrict automatic scanning of untrusted TAR archives at the gateway and endpoint.
• Block or quarantine inbound TAR archives at mail and web gateways until engines are confirmed patched.
• Layer a second detection engine or sandbox that does not share the same TAR parser implementation.
• Track the note that this CVE may be split; monitor vendor advisories for per-product identifiers and patches.

Detection

• Hunt for TAR archives where an entry's declared length field exceeds the total file size.
• Alert on TAR files passing through mail/web gateways that are subsequently executed or extracted on endpoints.
• Correlate endpoint AV logs showing archives scanned without detection against later malware execution from the same file.
• Monitor vendor advisories and engine version inventories to identify unpatched TAR parsers in the environment.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.